OceanAltOceanAlt

PAYMENT PAGE CHECK · FREE · NO SIGNUP

Is this payment page real?

Some fake payment pages use an address that looks exactly like the real one, for example amazon with its first letter swapped for a Cyrillic "а". People cannot see the difference, and AI agents do not look twice. Paste the address and we show who it looks like, what is off, and what the real domain is.

Try one:

First look: this address has letters that are not English (decoded locally, not checked yet)

What you see
аmazon.com
What is actually sent
xn--mazon-3ve.com
Look-alike letters
  • а U+0430 · Cyrillic, looks like Latin "a"
Press Check or pick an example above. The result appears here: the verdict, who it imitates, the real domain, each signal we used, and what to do next.

What we check

  • Hidden look-alike letters

    We decode xn-- punycode back into what you actually see and mark each Cyrillic, Greek or other non-English letter, plus the English letter it imitates.

  • Brand impersonation

    We compare the domain with the official domains of well-known merchants and payment brands, looking for near-identical spellings and for a brand name glued to words like "checkout" or "login".

  • Phishing lists

    We check the domain and its parent domains against public phishing-domain lists.

  • Other odd shapes

    A bare IP, a private network address, very deep subdomains or free hosting all get flagged for a second look.

Why AI agents are easier to fool

When people pay, they still glance at the address bar, the browser warnings and whether the page looks right. An agent gets a string of text. It reads "amazon", treats it as Amazon, and pays within seconds, with nobody stopping to look.

So this step has to happen in code, before the payment: the agent hands the URL to this check first and stops if it gets back "risky".

What this check cannot tell you

No warning signs does not mean the page is real. A brand new fake site may not be on any list yet, or may copy a brand we do not cover. We also do not open the page or read its content; we only look at the address. The payee address is a separate question; check it on the address page.

INTEGRATE

HTTP

GET https://oceanalt.com/api/endpoint?url=https://pay.example.com/checkout

Returns verdict (risky / caution / clear / uncertain) and signal_keys. clear means nothing was found; uncertain means the check did not run.

MCP

claude mcp add --transport http oceanalt https://oceanalt.com/api/mcp

Tool name screen_endpoint, argument url.

API docs →·Check the payee address too →